Your data will be processed by Redeia Corporación S.A. and/or by the companies that make up Redeia (hereinafter, RE), depending on the recipient of your request or the relationship you have established with each of them. You can consult the companies that are part of RE at https://www.redeia.com/en/about-us/who-we-are, of which we provide more information below:

Identidad de la entidad principal: Redeia Corporación S.A. con C.I.F.: A-78003662.

Identity of the main entity: Redeia Corporation S.A. with Tax ID (C.I.F.) number: A-78003662.

Other companies of Redeia responsible for processing:

• Red Eléctrica de España S.A.U. with C.I.F.: A-85309219.
• Red Eléctrica Internacional S.A.U. with C.I.F.: A-82852906.
• Red Eléctrica de España Finance, B.V. with registration number: NL812199017B01.
• Redeia Financiaciones S.L.U. with C.I.F.: B-42954917.
• REDCOR Reaseguros, S.A. With registration No. B153252.
• REDEIA INFRAESTRUCTURAS DE TELECOMUNICACIÓN, S.A. with C.I.F.: A-87323127.
• Red Eléctrica Infraestructuras en Canarias, S.A.U. with C.I.F.: A-76234822.
• Redeia Sistemas de Telecomunicaciones S.A.U. with C.I.F.: A-88044144.
• ELEWIT, S.A. with C.I.F.: A-88409990.

Postal address for notification purposes: Paseo Conde de los Gaitanes No 177, La Moraleja, 28109 Alcobendas (Madrid).

RE may process the following types of personal data, depending on the relationship established with the user:

• Identification and contact data (e.g. first name, surnames, identity document, telephone, email, country of residence).
• Browsing data (e.g. use of the website, sections visited)
• Other types of data. Exclusively in the event that the user has voluntarily provided another type of data, as they understand it to be relevant to their request or query and/or by other means (e.g. provided via telephone queries).

The data that RE processes as a result of the interactions carried out by the user through the website comes from the following sources:

• Data provided by the user by filling in forms made available by RE, by sending emails or by any other means through which the user establishes communication with Redeia.
• Data generated as a result of browsing and use by the user of the web.

In general, your data will be processed by RE for the fulfilment of the following purposes:

1. PURPOSE 1: Management of users and provision of services offered through our website.

• Description of the purpose: RE will process your data to provide you with the services we offer on our website and manage registrations as a user in those sections of the website that require prior registration to access the reserved area.
• Base of legitimisation: Art 6.1.b) GDPR – the processing is necessary for the execution of a contract in which the interested party is a party or for the application at the request of the latter of pre-contractual measures.
• Data processed for this purpose: Identification and contact data (name, surnames, postal or electronic address, identity document, telephone number) and data related to the position, job or professional function performed, if applicable.

2. PURPOSE 2: Manage requests for information, queries, requests and doubts through the forms enabled on the web, through postal or electronic mail, or by telephone contact.

• Description of the purpose: RE will process your data to respond to requests, queries, requests and doubts made available to us through forms provided for this purpose on the website, by email or post, or by telephone contact, and put at your disposal solutions that suit your needs. Phone calls may be recorded in order to ensure the quality of the service and for security purposes.
• Base of legitimisation: Art. 6.1b) GDPR – processing is necessary for the execution of a contract in which the interested party is part of or for the application at the request of the latter of pre-contractual measures.
• Data processed for this purpose: Identification and contact data (first name, surnames, identity document, postal or electronic address, telephone number, voice).

3. PURPOSE 3: Compliance with legal obligations required of RE.

• Description of the purpose: RE, in its capacity as data controller, is obliged to comply with the provisions, among others, with the regulations of the electricity sector, as well as with those obligations necessary for the fulfilment of the functions as operator of the electricity system and manager of the electricity transmission grid. This requires you to provide your personal data to Public Administration bodies, courts, regulatory bodies and State Security Forces and Bodies.
• Basis for legitimisation: Art. 6.1c) GDPR – processing is necessary for the fulfilment of a legal obligation applicable to the data controller.
• Data processed for this purpose: Identification and contact data (first name, surnames, identity document).

4. PURPOSE 4: Send newsletters and subscription to newsletter.

• Description of the purpose: At RE there are forms where you can grant your unequivocal consent to authorise the receipt of information through bulletins and newsletters, both by ordinary and electronic means, as well as information about the activities organised by RE.
• Basis for legitimation: Art. 6.1a) GDPR – the interested party gave their consent for the processing of their personal data for one or more specific purposes.
• Data processed for this purpose: Identification and contact data (name, surnames, postal or electronic address).

It should be noted that you may object at any time to the purpose of processing your personal data for advertising or promotional purposes by RE, using the channels enabled for this, as detailed in the section. What are your rights when you provide us with your data?

5. PURPOSE 5: Developing perception studies.

• Description of the purpose: In order to be able to verify your degree of satisfaction with the work carried out by RE, we may carry out perception studies to improve the quality of our procedures and services.
• Base of legitimisation: Art. 6.1f) GDPR – the processing is necessary for the satisfaction of legitimate interests pursued by the data controller or by a third party.
• Data processed for this purpose: contact data (first name, surnames, postal or electronic address, contact telephone number) and data relating to the position, job or professional function performed.

In any case, and if it is necessary for the fulfilment of the processing purposes RE may give access to personal data to third party service providers, who will access them as data processors. In the event that this access involves the transfer of your personal data outside the European Economic Area, RE will ensure the existence of adequate mechanisms and guarantees provided for by the applicable regulations (e.g. Standard Contractual Clauses) to guarantee that the provider applies a level security equivalent to that required by European data regulations.

In general, the contents and services of RE are directed and designed mostly for people over 18 years of age.

However, there is content on our website intended for minors which includes online games to which they can have access.

In such case, RE will request the consent of the holders of their parental authority or guardianship, or legal representative, for users under 14 years of age, not collecting or processing personal data in any case without fully complying with the requirements established in the applicable data protection legislation in relation to compliance with the duty to inform and to obtain any necessary consents.

RE will store the personal data provided for the period necessary to manage your request, query, suggestion, complaint or claim, or as long as the contractual relationship is maintained, its deletion or opposition is not requested by the interested party and they should not be deleted since they are necessary to comply with a legal obligation or for the formulation, exercise and defence of claims.

In this regard, RE will store and duly block the personal data once its relationship with you has ended, and will only make it available to the Public Administrations, Judges and Courts for the attention of the possible responsibilities arising from the processing, as well as for the exercise and defence of claims at the Spanish Agency for Data Protection and will be stored during the prescription period of the actions that may arise from the relationship maintained with the user.

Your personal data will be stored for the time necessary to fulfil the purpose for which it was collected. If your data is used for several purposes that require us to store it for different periods, we will apply the longest retention period.

In each process in which you provide your personal data, you will be informed of the mandatory or optional nature of its completion (for example, marking with asterisks those fields in which mandatory data is requested), and of the consequences of not providing said data.

Through this Privacy Policy, you declare that the information and data you provide us are accurate and truthful, with RE reserving the right to exclude from the services any interested parties who have provided false data, without prejudice to the possibility of initiating legal actions. You will be solely responsible for any false or inaccurate statements you make and for the damages that this may cause to RE or third parties.

If, by means of any form, you provide us with third-party personal data, you guarantee that you have informed said third party of this Privacy Policy and that you have obtained their authorisation to provide RE with their data for the purposes indicated.

In compliance with article 14 of the GDPR, RE undertakes to provide any third party whose data provides us with the relevant information.

RE will communicate and transfer your personal data for the fulfilment of the purposes indicated above and on the basis of the legitimising bases of the treatment previously indicated to:

• Redeia companies, which you can consult at the following link: https://www.redeia.com/en/about-us/who-we-are.
• The Public Administrations and the Administration of Justice, State Security Forces and Bodies and, in general, competent Authorities when RE has the legal obligation to provide them.
• RE suppliers that have access to your personal data that will process said data as RE treatment managers, as a result of the services they provide to RE. All suppliers with access to personal data that provide services to RE have signed the corresponding data controller contract in accordance with the provisions of article 28 of the GDPR, taking it upon themselves to comply with the following obligations: apply appropriate technical and organisational measures; process the personal data for the agreed purposes and attending only to the documented instructions of RE and the obligation to delete the data once the provision of the services has ended.
• Due to the activity carried out by RE, there is the possibility of international data transfers to countries located outside the European Economic Area (EEA). For cases in which international data transfers are made to countries outside the European Economic Area (EEA) or to countries that do not offer an adequate level of protection, the necessary measures will be applied with adequate guarantees through the use of Standard Contractual Clauses that legitimise international transfer.

RE applies and maintains appropriate technical and organisational measures to guarantee an adequate level of security based on prior risk analysis.

Specifically, RE has established all the technical means at its disposal to prevent the loss, misuse, alteration, unauthorised access and theft of the data you provide us.

RE informs you that you have the right to obtain confirmation on whether we are processing personal data that concerns you or not.

Likewise, RE informs you that you may exercise the following rights over your personal data:

• Access: You have the right to access your data to know what personal data we are processing that concerns you.
• Rectification or deletion: In some circumstances, you have the right to rectify any personal data that you consider to be inaccurate and that concern you, and that are processed by ER, as well as the right to request the deletion of your data when, among other reasons, the data were no longer necessary for the purposes for which they were collected.
• Limitation: In some circumstances, you will have the right to request us to limit the processing of your data, in which case we inform you that we will only store the data on which you have requested limitation in the processing for the exercise or defence of claims.
• Portability: In some circumstances, you will have the right to receive the personal data that concern you, and that you have provided us, in a structured format for common use and mechanical reading, as well as to have them transmitted by ER to another data controller.
• Opposition: In some circumstances, and for reasons related to your particular situation, you will have the right to object to the processing of your data, in which case, we would stop processing them unless we are obliged to continue to do so for compelling reasons or for the exercise or defence of possible claims.